Privacy Policy

1. Scope and Overview

1.1 Operator Identity

SiteHunter.io LLC, a Texas limited liability company (“SiteHunter,” “we,” “us,” or “our”) operates the website located at https://sitehunter.io and all associated subdomains, APIs, and services (collectively, the “Service”). Our principal place of business is in Austin, Texas.

1.2 Geographic Scope

The Service is directed exclusively to residents of the United States. By accessing or using the Service, you represent that you are located in the United States. We do not intentionally collect data from, or direct the Service toward, residents of the European Economic Area (EEA), the United Kingdom, or Canada.

1.3 Two Categories of Data Subjects

This Policy addresses two categories of data: (a) Platform User Data — information about visitors, people joining our waitlist, and registered users; and (b) Business Subject Data — information about third-party businesses surfaced in search results, including public contact information and assessments derived from it. Business records may include information identifying an owner, sole proprietor, or other business representative. These categories describe how we use the data; they do not determine whether a particular record is personal information under applicable law.

1.4 Effective Date and Updates

This Policy is effective as of November 5, 2026. We may update this Policy from time to time. If we make material changes, we will notify registered users by email at the address associated with their account at least thirty (30) days before the changes take effect. Continued use of the Service after the effective date of any updated Policy constitutes acceptance of the updated terms.

2. Account and Visitor Data

2.1 Information You Provide Directly

• Email address — required to create and maintain your account.
• Password — stored as a one-way cryptographic hash. We never store your password in plaintext and cannot retrieve it.
• Profile and onboarding information — information you submit, such as your display name, company, and selected home city, including the coordinates associated with that city.
• Search query inputs — the business type and city or geographic location you enter when initiating a market scan.
• Saved results and feedback — leads you save, preferences, ratings or reports you submit about results, and messages you send to support.
• Waitlist information — your email and any information you submit when requesting access.

2.2 Information Collected Automatically

• IP address and approximate location — IP address, inferred city, region, country, postal area, and network information collected with signup and usage metadata. IP addresses are also used for security and fraud prevention. This is not continuous GPS tracking.
• Device and browser signals — browser, operating system, screen size, timezone, and a device identifier collected with signup metadata.
• Usage and diagnostic information — pages visited, actions taken, results viewed, credit transactions, timestamps, errors, and performance information. Events can be associated with your session and, when signed in, your account.
• Referral and campaign information — referring pages and campaign parameters associated with a visit or signup.
• Browser storage and identifiers — cookies, local storage, and session storage used for preferences, authentication-related flows, cached results, and session or campaign identification. Some stored values are sent to us or our providers when you use the Service; see Section 9.
• Your privacy choices — the choices you make in our banner or in Your Privacy Choices, when you made them, and whether your browser sent Global Privacy Control (Sections 9.3 and 9.5).

2.3 Payment and Transaction Data

Our payment processor collects payment card details through its secure checkout. SiteHunter.io does not store your full card number or security code. We exchange account and purchase information with the payment processor, including your email address, account identifier, and purchase quantity. We retain purchase records such as transaction identifiers, amounts, payment status, Credits purchased, and your Credit balance. The payment processor’s handling of payment information is governed by its own privacy policy.

2.4 Information We Do Not Collect

We do not collect Social Security numbers, government identification, or financial account numbers. We do not collect sensitive personal information as defined under California law beyond what is disclosed. We do not knowingly collect personal information from individuals under 18 years of age.

2.5 The Waitlist

When you join the waitlist, we keep your email address and when you joined. We also record your IP address, your approximate location (our location provider looks it up from your IP address), browser and device details, how long the page was open, and how you found us, such as the referring page and any campaign tags in the link.

• Why. To confirm your spot, send your invite, and keep the form free of spam and abuse.
• What we send. A confirmation now and an invite when a spot opens.
• Security. Google reCAPTCHA checks the form for bots (Section 9.6). If a signup trips our abuse checks, we may log your IP address and email address.
• Your choices. Email support@sitehunter.io to see, correct, or delete your entry.
• Advertising. If you accepted advertising, our servers may tell Meta that you joined (Section 9.3).

3. Business Information in Search Results

3.1 Categories of Business Data Collected

3.2 Nature of Business Data Collection

3.2.1 Publicly Accessible Sources. All business data is sourced exclusively from publicly accessible sources. These include public business listing services, publicly accessible websites, and publicly available email addresses associated with business domains. We do not purchase data from private data brokers, and we do not access any non-public or password-protected systems to obtain business data.

3.2.2 Business-Focused Collection. We collect information for business research, not to investigate private lives. A business listing or website may nevertheless identify a sole proprietor, owner, employee, or other representative. Personal information does not lose applicable privacy protections merely because we label it business data. See Section 10 for requests concerning information about you.

3.2.3 Automated Website Analysis. We fetch and render publicly accessible pages to examine technical signals, visible content, screenshots, and business contact or ownership evidence. AI providers may help analyze that material as described in Section 6. This research does not attempt to access restricted areas, submit forms, create accounts, or obtain private data from a business website.

3.3 Longitudinal Quality Score Retention

We maintain website assessment records to track business website conditions over time. Retention is not identical for every field: source-provider restrictions and field-level cleanup can require information to be refreshed or removed. Business information that identifies an individual is subject to applicable privacy rights, including the request process in Section 10. See Section 7 for retention information.

4. How We Use Platform User Data

4.1 Service Operation and Account Management

We use your Platform User Data to:

• Create, authenticate, and maintain your account.
• Process search queries and deliver search results.
• Track and manage your credit balance.
• Process payments through our third-party payment processor.
• Provide customer support and respond to inquiries.
• Maintain your search history and saved results.

4.2 Fraud Prevention and Abuse Enforcement

We use IP addresses, device metadata, and usage patterns to:

• Detect and prevent fraudulent account creation.
• Enforce our one-account-per-user policy.
• Identify and block automated abuse or scraping of the Service.
• Enforce rate limits to maintain Service availability.

4.3 Communications

We use your email address to send:

• Transactional emails — account verification, password reset, purchase confirmations, and credit balance notifications. These are necessary for account operation and cannot be opted out of.
• Marketing emails — product updates, new features, and promotional offers. You may opt out of marketing emails at any time by clicking the “unsubscribe” link in any marketing email or by contacting us at support@sitehunter.io.

4.4 Service Improvement

We use session- and account-associated usage events, diagnostic information, and aggregate reports to:

• Analyze how the Service is used to identify areas for improvement.
• Monitor system performance and reliability.
• Develop new features and capabilities.
• Conduct internal research and analytics.

When you’re signed in, our analytics provider links your activity to your user ID, email address, and display name, so these analytics aren’t anonymous. Our error monitoring provider can receive identifiers and diagnostic context when an error occurs. You can turn off usage analytics and session recording in Your Privacy Choices (Section 9.5).

4.5 Legal Compliance

We may use your data as necessary to comply with applicable laws, respond to valid legal processes, or protect our legal rights.

4.6 Advertising (Only If You Accept)

If you accept advertising, we use information about your visits to our marketing pages, and about any waitlist signup, new account, or purchase, to measure our ads and decide who sees them. We share it with advertising companies, which may also use it for their own advertising (Section 9.3).

5. Who Receives Information

5.1 Third-Party Service Providers

We use providers for the functions below. Optional analytics and monitoring depend on the features and configuration in use; this list does not mean every provider receives every category of information.

Providers supporting accounts, service operation, and measurement:

Providers used for public-business research and analysis:

5.2 Other Disclosures

5.2.1 Legal Requirements. We may disclose your data if required by law, subpoena, court order, or other valid legal process, or if we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

5.2.2 Business Transfers. In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your data may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service of any change in ownership or uses of your personal information.

5.2.3 Sale and Sharing for Advertising. We don’t sell, rent, or trade your personal information for money. If you accept advertising, we share the information described in Section 9.3 with advertising companies, which may use it for their own advertising. Some state laws, including California’s, call this “sharing” or a “sale.” If you don’t accept, we share nothing with them.

5.2.4 Third-Party Marketing. We don’t give your personal information to other companies for their own direct marketing, except that advertising companies may use what they receive under Section 9.3 for their own advertising, and only if you accept.

6. Automated Decision-Making and AI Systems

6.1 Website Quality Scoring System

Automated website assessments use technical checks, visible design, and available business evidence such as public reviews. Separately, we collect online-presence and contact information to support users’ lead research.

Lead assessments concern businesses and their public web presence. They are informational outputs for a user’s own research, not a prediction that a business will purchase services or permission to contact someone in violation of applicable law.

6.2 AI-Assisted Website and Contact Analysis

When AI-assisted analysis runs, our AI model providers may process:

• Text and screenshots from publicly accessible business pages.
• Business names, locations, and website context needed to interpret the evidence.
• Public ownership, role, and contact evidence to help identify business representatives.

These outputs can be incomplete or inaccurate. Our business-analysis requests are designed around public-business evidence, not Platform User passwords or payment card details. We will update this Privacy Policy before deploying an AI system that processes personal data in new ways.

6.3 Review and Security Decisions

We provide tools for reviewing automated outputs and reporting data-quality issues; not every result is manually reviewed. Separately, automated security checks use account, IP, and request signals, including anti-bot verification, to identify abuse and may restrict signup or access. If you believe a result or an access restriction is incorrect, contact support@sitehunter.io.

7. Data Retention

7.1 Platform User Data Retention

Account deletion requests are currently handled through support. Removing a saved lead from your list is not the same as deleting your account or the underlying business record. See Section 10 to make a privacy request.

7.2 Business Subject Data Retention

Business information is retained for research, result delivery, and assessment history. Different fields may be refreshed or removed at different times, including to meet source-provider restrictions. We do not treat all business information as permanently retained or categorically exempt from privacy requests. If a record identifies you, you can contact us using Section 10; applicable rights depend on the information and law involved.

7.3 Ephemeral Data

Certain data is processed transiently and not retained beyond the immediate processing session.

8. Data Security

8.1 Security Measures

We implement reasonable administrative, technical, and physical security measures to protect your data, including:

• Encryption of data in transit using TLS/SSL.
• Encryption of sensitive data at rest.
• One-way cryptographic hashing of passwords (passwords are never stored in plaintext).
• Access controls limiting employee access to personal data on a need-to-know basis.
• Regular security assessments and monitoring.
• Secure API authentication for all service-to-service communications.

8.2 Acknowledgment of Risk

No method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your personal information, we cannot guarantee its absolute security.

8.3 Your Responsibilities

You are responsible for maintaining the confidentiality of your account credentials. You should use a strong, unique password and should not share your login information with any third party. Notify us immediately at support@sitehunter.io if you believe your account has been compromised.

9. Cookies, Tracking, and Advertising

9.1 Essential Session Data

We use session cookies or equivalent mechanisms to maintain authentication and support security and account flows. Blocking these mechanisms in your browser may prevent sign-in or other essential features from working.

9.2 User Preference Storage

Local and session storage can hold display preferences, selected locations, cached results, and session or attribution identifiers. Some values stay on your device; others are sent when you take an action such as signing up, purchasing Credits, or running a scan. You can clear browser storage through your browser settings, which may reset preferences or sign you out.

9.3 Advertising (Only If You Accept)

We share information with advertising companies only if you accept. Today, the only one is Meta Platforms, Inc. (Facebook and Instagram). We may switch advertising off at times. While it’s off, our banner doesn’t appear and Meta’s pixel doesn’t load, even if you accepted. Outside the United States, we don’t show the banner or load Meta’s pixel, and our servers send Meta nothing about a waitlist signup, new account, or purchase you start there. We go by the country of your internet connection.

• We ask first. Our homepage and other marketing pages show a banner with Reject and Accept. Nothing advertising-related loads until you choose Accept. Choosing Accept there also turns on usage analytics and session recording in that browser (Section 9.4). Closing the banner isn’t a choice: nothing loads, and we may ask again on a later visit.
• Who collects, and why. Other companies, including Meta, may use cookies, pixels, and other storage technologies on our site to collect or receive information from it and from elsewhere on the internet, and use that information to measure ads and to target ads. Today, Meta is the only one, and only if you accept.
• On our marketing pages. If you accept, Meta’s pixel loads on our homepage and other marketing pages. Meta receives the pages you view there and the page you came from, your IP address, browser and device details, and IDs stored in Meta’s cookies. The pixel never loads on the waitlist page, sign-up, sign-in, pricing, or any page inside the app.
• From our servers. If you accept, our servers may also tell Meta when you join the waitlist, create an account, or make a purchase, including the amount paid. Each may also include your IP address, browser details, Meta’s cookie IDs, and the page it happened on.
• What we never send. Your name, email address, or phone number, or anything about the businesses in your results.
• Why we use it. To measure our ads and to decide who sees them.
• What Meta does with it. Meta may use it for its own advertising, including to deliver ads to you, and may link it to your Facebook or Instagram account, under Meta’s own privacy policy.
• Where your choice applies. Only in the browser where you make it, and only on the site address where you make it: sitehunter.io and app.sitehunter.io each keep their own choices. It applies signed in or not. We don’t link it to your account.
• How long your choice lasts. An Accept or a Reject lasts 12 months from when you make it. Your advertising choice and your usage analytics and session recording choice each have their own 12 months; changing one doesn’t extend the other. After a Reject, we won’t ask again in that browser until then. If we add an advertising company or start sending something new, we ask again before that part starts.
• Changing your mind. Turn off Advertising (Meta) in Your Privacy Choices. It takes effect in that browser at once: Meta’s pixel stops, and we delete Meta’s cookies on our site. Usage analytics and session recording are a separate choice there (Section 9.5). We can’t recall what Meta already received.
• Global Privacy Control. If your browser sends it, we treat it as a Reject: you won’t see the banner, the pixel never loads, and nothing you do in that browser is sent to Meta.
• Ads from Meta and other companies. Turning off Advertising (Meta) stops what we share. It doesn’t change how Meta uses what it already has, or what it gets from other sites. For that, use Meta’s Ad preferences and Your activity off Meta technologies (both need a Meta login). To opt out of interest-based ads from many companies at once, use the Digital Advertising Alliance’s YourAdChoices. Meta and the Digital Advertising Alliance run these tools, not us.
• Records. For each choice you make in the banner or in Your Privacy Choices, we keep:
  • the date and what you chose;
  • which choice it was: advertising, or usage analytics and session recording;
  • the version and exact wording you saw (we keep a copy of every version);
  • whether you chose in the banner or in Your Privacy Choices, and on which page;
  • whether you had opened the banner’s details;
  • whether your browser sent Global Privacy Control;
  • whether you were signed in;
  • a record ID that’s also stored in your __Host-sh-consent cookie.
  The record doesn’t include your IP address, browser details, or user ID. We keep it for 24 months (Section 7.1). Separately, to limit abuse, we log the IP address each choice is sent from, with the time it arrived, and delete that log within 3 days.

Some state laws call this “sharing” personal information for targeted advertising, or a “sale.” It happens only if you accept.

9.4 Usage Analytics and Session Recording

Our analytics provider runs two things:

• Usage analytics record the pages you visit and the actions you take.
• Session recording captures clicks, scrolling, and what’s on screen, such as your scan results, so we can see where SiteHunter is confusing or broken. What you type is hidden, except city names.

The provider stores an ID in a cookie and in your browser’s storage. Its requests go through our own domain, and it may receive your IP address.

If you’re signed in, both run by default, and the provider links them to your user ID, email address, and display name.

If you’re not signed in, the provider doesn’t run unless you choose Accept in our banner (Section 9.3) or turn on usage analytics and session recording in Your Privacy Choices. If you do, both run in that browser, tied to the provider’s ID rather than to an account. If you later sign up or sign in in that browser, the provider may link that earlier activity to your account.

Whether or not you’re signed in, we also record a few actions in our own database, such as when you open our pricing page. When you’re not signed in, they’re tied to a random ID that lasts until you close the tab.

You can turn off usage analytics and session recording in Your Privacy Choices (Section 9.5). They turn off together. Error reports and page-speed measurement aren’t affected by these choices.

9.5 Your Privacy Choices

• Your Privacy Choices. The Your Privacy Choices page shows your choices in this browser and lets you change each one: advertising (Section 9.3), and usage analytics with session recording (Section 9.4). We keep your choices in a cookie in this browser (Section 9.7). They apply only to that browser and to the site address you’re on (sitehunter.io and app.sitehunter.io each keep their own), signed in or not, and aren’t linked to your account.
• What turning off usage analytics stops: our analytics provider in this browser, including session recording. We also delete the provider’s cookie and the IDs it stored in this browser. Our servers still send the provider a few account events, such as when you run a scan or buy credits, tied to your user ID. Sign-in, security checks, error reports, and page-speed measurement keep working.
• Global Privacy Control. If your browser sends it, we treat it as a request to turn off advertising, usage analytics, and session recording in that browser, with no further step. Your Privacy Choices shows when we’ve detected it.
• Do Not Track. We don’t respond to the older Do Not Track setting, because there’s no agreed standard for what it means. We honor Global Privacy Control instead.

9.6 Tracking by Other Companies

We don’t let other companies collect personal information about your activity over time and across other websites when you use SiteHunter, with these exceptions:

• Google reCAPTCHA, our security check, runs on the sign-in page, the waitlist page, and every dashboard page. It collects device, browser, and interaction signals, plus your IP address, to check for bots. Google says it doesn’t use this information for personalized advertising. The same service runs on many websites, so Google can recognize your browser across them.
• Meta, only if you accept advertising (Section 9.3). Meta may combine what it collects on our marketing pages with what it learns on other websites and apps, under its own policy.

9.7 Cookies for Your Privacy and Advertising Choices

These cookies remember your privacy choices, or are Meta’s, set only if you accept advertising.

10. Your Privacy Rights

10.1 Rights Available to All U.S. Residents

Regardless of your state of residence, you may:

• Access the personal information we hold about you.
• Request correction of inaccurate personal information we hold about you.
• Request deletion of your account and associated personal data.
• Opt out of marketing emails at any time.
• Turn off advertising, or usage analytics and session recording, in Your Privacy Choices (Sections 9.3 and 9.5).
• Update your account information through the Service interface.

10.2 California Residents — CCPA/CPRA Rights

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to Know. You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collection, and the categories of third parties with whom we share it.
• Right to Delete. You may request that we delete the personal information we have collected about you, subject to certain legal exceptions.
• Right to Correct. You may request that we correct inaccurate personal information we maintain about you.
• Right to Opt Out of Sale/Sharing. We share personal information with advertising companies only if you accept (Section 9.3). California law may treat this as “sharing” or a “sale.” To opt out, turn off Advertising (Meta) in Your Privacy Choices, or use Global Privacy Control.
• Right to Limit Use of Sensitive Personal Information. We do not collect sensitive personal information as defined under California law beyond what is necessary to provide the Service.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of your CCPA/CPRA rights.

CCPA Categories Disclosure: In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA: Identifiers (email address, IP address); Commercial information (credit purchase records, transaction history); Internet or electronic network activity (usage logs, pages visited, features used); and Geolocation data (derived from IP address — city/state level only, not precise location).

Sharing for advertising: If you accept advertising, we may share these categories with Meta: Identifiers (IP address and Meta cookie IDs); Internet or electronic network activity (browser and device details, the marketing pages you view, and that you joined the waitlist or created an account); and Commercial information (purchases, with the amount paid). We share nothing with Meta if you haven’t accepted, and we don’t share other categories for advertising. We don’t sell personal information for money.

10.3 Texas Residents — TDPSA Rights

If you are a Texas resident, you have the following rights under the Texas Data Privacy and Security Act:

• Right to Access. You may confirm whether we are processing your personal data and access that data.
• Right to Correct. You may correct inaccuracies in your personal data.
• Right to Delete. You may request deletion of your personal data.
• Right to Data Portability. You may obtain a copy of your personal data in a portable, readily usable format.
• Right to Opt Out. You may opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects. We use personal data for targeted advertising, and share it in ways some state laws call a “sale,” only if you accept (Section 9.3). You can opt out anytime in Your Privacy Choices or with Global Privacy Control. We don’t profile you in ways that produce legal or similarly significant effects.

10.4 How to Submit a Privacy Rights Request

To exercise any of your privacy rights, you may:

• Email us at support@sitehunter.io with the subject line “Privacy Rights Request.”
• Include your account email address and specify the right(s) you wish to exercise.

We will verify your identity by confirming ownership of the email address associated with your account. We will respond to verified requests within 45 days. If we need additional time (up to an additional 45 days), we will notify you of the extension and the reason.

10.5 Authorized Agent

You may designate an authorized agent to submit privacy rights requests on your behalf. Authorized agents must provide written proof of authorization signed by you, along with verification of the agent’s own identity. We may contact you directly to confirm the authorization.

11. Children’s Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe that a child under 18 has provided us with personal information, please contact us at support@sitehunter.io.

12. Links to Third-Party Services

The Service may contain links to websites or services operated by third parties. This Privacy Policy does not apply to those third-party services. We are not responsible for the privacy practices of third-party websites. We encourage you to review the privacy policies of any third-party services you access through links on our Service.

13. Contact Information

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

SiteHunter.io LLC
Austin, Texas 78751
Email: support@sitehunter.io

14. Additional State-Specific Disclosures

14.1 Virginia — Virginia Consumer Data Protection Act (VCDPA)

Virginia residents have rights similar to those described in Sections 10.2 and 10.3, including the right to access, correct, delete, and obtain a copy of personal data, as well as the right to opt out of targeted advertising, sale of personal data, and profiling. We use personal data for targeted advertising, and share it in ways some state laws call a “sale,” only if you accept (Section 9.3). You can opt out anytime in Your Privacy Choices or with Global Privacy Control. We don’t profile you in ways that produce legal or similarly significant effects. To exercise your rights, contact us at support@sitehunter.io. If we decline your request, you may appeal by contacting us within 30 days, and we will respond to your appeal within 60 days.

14.2 Colorado — Colorado Privacy Act (CPA)

Colorado residents have the right to access, correct, delete, and obtain a portable copy of their personal data, as well as the right to opt out of targeted advertising, sale of personal data, and profiling. We use personal data for targeted advertising, and share it in ways some state laws call a “sale,” only if you accept (Section 9.3). You can opt out anytime in Your Privacy Choices or with Global Privacy Control. We don’t profile you in ways that produce legal or similarly significant effects. Colorado residents may exercise their rights by contacting us at support@sitehunter.io. If we decline your request, you may appeal, and we will respond within 45 days. If the appeal is denied, you may contact the Colorado Attorney General.

14.3 Connecticut — Connecticut Data Privacy Act (CTDPA)

Connecticut residents have rights substantially similar to those provided under the Colorado Privacy Act, including the right to access, correct, delete, and obtain a portable copy of personal data, and the right to opt out of targeted advertising, sale of personal data, and profiling. We use personal data for targeted advertising, and share it in ways some state laws call a “sale,” only if you accept (Section 9.3). You can opt out anytime in Your Privacy Choices or with Global Privacy Control. We don’t profile you in ways that produce legal or similarly significant effects. Connecticut residents may exercise their rights by contacting us at support@sitehunter.io. If we decline your request, you may appeal, and we will respond within 60 days.